An employee of the covered entity (CE) impermissibly accessed medical records containing the protected health information (PHI) of 1,740 patients for a period of 4 �� years. The PHI affected by the breach included the demographic information of 691 individuals, and both demographic and clinical information of 1,049 individuals. Following the breach, the CE conducted an investigation, terminated the involved employee, re-trained its employees regarding patient privacy and access to PHI, and enhanced its supervision and monitoring of employees' PHI access activities. It also provided breach notification to the affected individuals, HHS, and the media, as well as substitute notice on its website. OCR obtained assurances that the CE completed the voluntary compliance action described above. \ \
